Better and Fairer Schools (Information Management) Bill 2024 - Commentary on Ministerial Responses [2024] AUSStaCSBSD 180 (11 September 2024)

2.1 This chapter considers the responses of ministers to matters previously raised by the committee.

	Home \| Databases \| WorldLII \| Search \| Feedback Australian Senate Standing Committee for the Scrutiny of Bills - Scrutiny Digests

Better and Fairer Schools (Information Management) Bill 2024^[61]

Purpose	This bill seeks to expand the current requirements under the Student Identifiers Act 2014 to enable the extension of the system of unique student identifiers for vocational education and training and higher education students to primary and secondary school students.
Portfolio	Education
Introduced	15 August 2024
Bill status	Before the Senate

Privacy^[62]

2.2 The Student Identifiers Act 2014 (the Act) sets out a scheme establishing unique student identifiers. The student identifier scheme (the scheme) commenced from 1 January 2015 for students in national vocational education and training (VET).^[63] The purpose of the scheme was described as to allow VET students to create a single identifier to consolidate their education and training transcripts.^[64] The scheme was later extended to include all higher education students who commenced higher education from 1 January 2021.^[65] At the time the Student Identifiers Bill 2014 (the bill) was introduced, this committee raised concerns in relation to the privacy of personal information as the bill permitted authorised entities to collect, use and disclose student identifiers in specified circumstances.^[66]

2.3 The current bill seeks to expand the scheme to apply student identifiers to all primary and secondary students by 2025, with an impact on over 5 million school children (which would increase each year as new students commence their education). The committee requested the minister’s advice in Scrutiny Digest 10 of 2024 on the following matters:

Minister for Education’s response^[68]

2.4 The minister advised that expanding the scheme to all school students will support student learning and provide evidence on educational progress and pathways to inform stronger education outcomes through policy and investment. The minister also noted that the expansion of the scheme is supported by a number of reviews into education which argued that expanding the scheme is necessary for consistency of student growth data, maximising and supporting student growth, facilitating innovations in education, tracking student performance and improving teacher interventions on a national level, and to organise and connect data and evidence at a national level to improve capacity for interventions.

Whether all entities involved with the collection, storage and disclosure of student information will be covered by the Australian Privacy Principles

2.5 The minister identified the following APP entities that will be involved in the collection, storage and disclosure of student identifier information:

2.6 The response confirmed that non-APP entities involved in the use of data under the scheme will include State and Territory public bodies and government schools. Relevant State and Territory privacy legislation will govern these non-APP entities. The minister noted that the States and Territories are in consultation with the Department of Education to establish a Data Governance Framework to apply to the scheme, which is intended to include a commitment for States and Territories to manage data in line with the APPs.

2.7 Further, the minister noted that the bill amends the Act to improve privacy protections, including by imposing requirements on data handlers to protect records from ‘misuse, interference and loss, and from unauthorised access, modification or disclosure’ and banning entities from collecting, using or disclosing protected information without authorisation. However, the minister also noted that the bill limits the application of these protections to exclude public bodies of a State or Territory, who will only be bound by them at the request of the State or Territory. Consultation is underway with the States and Territories in relation to this.

2.8 Finally, in relation to State and Territory privacy legislation, the minister noted that existing legislation will apply to the expansion of the scheme, and that as public bodies in the States and Territories already handle large volumes of protected student information these protections are already in operation. This applies with the exception of South Australia and Western Australia who, the minister noted, have no bespoke privacy legislation.

Whether school students who do not want to be assigned a student identifier may opt out of the scheme

2.9 The minister advised that the Australian Government is currently working on opt out arrangements with a variety of stakeholders. Potential options at this time include parents and carers choosing to opt out from the identifier system in its totality on behalf of their children or choosing to opt out or in for specific uses of the schools identifiers.

The type of information about students that is required to obtain a student identifier, who will keep this data, how long it will be retained for and who will have access to it

2.10 The minister advised that the schools identifier will have ‘school identity management information’ linked to it which will be maintained by education authorities. The minister advised that the details attached to the identifier will need to be maintained over the course of schooling in line with enrolment arrangements. The minister advised that the school management information will be specified in the regulations and will only include data elements already collected and used by education authorities for school enrolment purposes.

2.11 The minister advised that the schools identifier and school identity management information will be held by the Registrar and the relevant school or education authority, and also noted that this information is already collected by education systems across Australia. The minister noted that this information will be collected as part of enrolment and student transfer purposes and will be provided to the Registrar for the period an individual is enrolled in school education. The minister also advised that the Archives Act 1983 would apply to the retention of this information.

2.12 The minister finally advised that access to this information is restricted by the Act and detailed protocols and expectations for how the information will be handled will be included in a Data Governance Framework that is being developed by the Commonwealth government in consultation with the states and territories.

Whether consultation on expanding the scheme to schools was undertaken outside of government

2.13 The minister advised that the measures in the bill have been informed by reviews and research over many years.

2.14 In relation to consultation undertaken specifically in relation to the development of unique student identifiers for school students, the minister noted the following:

Whether a privacy impact assessment was undertaken in relation to the scheme’s expansion to all, and, if so, what the assessment revealed

2.15 The minister informed the committee that a privacy impact assessment (PIA) was completed in May 2024, as commissioned by the Department of Education to the Australian Government Solicitor.

... while the implementation of the project will impact on the privacy of individuals through the collection, use and disclosure of their personal information, the project has the potential to deliver considerable benefits to the community through improved education outcomes.

2.17 The PIA did make recommendations focusing on ‘transparency measures, data handling, data quality, identifiers, access and correction requests, and guidance’ with the Department of Education responding to these recommendations via its development and implementation of the bill.

Whether protected information provided for education research will be de-identified

2.18 The minister advised that the Data Governance Framework will set out the requirements which the Student Identifiers Registrar will need to meet when disclosing protected information. As part of these requirements, the minister advised it is ‘anticipated that any protected information released for national research purposes would be de-identified’.

Committee comment

2.19 The committee thanks the minister for this detailed response. In relation to the necessity of the expansion of the scheme, the committee considers that the information provided improves on the quality of the justification set out in the explanatory memorandum. The committee also welcomes the high level of detail that was provided in this response in relation to the broad consultation and research that was undertaken in relation to the bill and the scheme more broadly. The committee notes this information would have been useful had it been provided in the explanatory materials accompanying the bill. The committee reiterates there are significant privacy implications of applying student identifiers to all primary and secondary students by 2025. While the committee notes the importance of improving understanding of student progression and the national education evidence base, this must be balanced against the rights of all children to privacy. Whether the scheme appropriately balances these considerations rests largely on the strength of applicable safeguards.

2.20 The committee welcomes the advice that entities currently not subject to the APPs are currently undergoing consultation with the Department of Education to establish a Data Governance Framework, which is expected to impose the APPs on all relevant bodies. However, a number of concerns arise from this approach, including that it appears the Data Governance Framework will be crucial to the privacy implications of the scheme. Yet it is unclear what status this framework will have and it does not appear that it will be subject to any parliamentary oversight. Given the significance of the scheme’s impact on privacy the committee expects that this framework should have been developed in conjunction with the bill in order for the full picture of the privacy landscape to be available to the Parliament for consideration in making this legislation.

2.21 Further, while the committee welcomes the amendments made by the bill to the Act to improve privacy protections in some respects, these safeguards are limited in their application as they appear to exclude public schools unless specific measures are taken to apply them. The committee notes that while existing State and Territory privacy protections apply, in the context of this national scheme the preferable approach would be for consistency in data handling and management across the country, with appropriate parliamentary oversight. The committee also notes its concerns that Western Australia and South Australia have no specific privacy legislation but would be collecting, using and disclosing information pursuant to this scheme. Again, the committee considers that this matter should have been resolved prior to the implementation of the legislation and suggests that the bill should not commence until such agreements are in place.

2.22 In relation to the type of information that will be associated with a student identifier, the committee is concerned by the advice that this will be left to the regulations, which limits the ability of the Parliament to scrutinise their appropriateness. Noting that the minister has advised the information will ‘only include data elements already collected and used’ by schools, it is unclear why these matters cannot be more appropriately set out on the face of the bill as the relevant data should already be known. Further, noting that the data is already known, it is unclear why this specific information could not have been included in the response as this is the information the committee requested. Answers to these issues would have helped the committee in balancing the intrusion on the privacy of children against the justifications and necessity of the scheme. The committee is also concerned that the detailed protocols and expectations for how the information will be handled will be included in a Data Governance Framework, which does not have legal status. Further, the committee is concerned that the bill does not specify any limitation on the duration of time for which the information will be retained. While noting the advice that the Archives Act 1983 applies to the retention of student identifier information, the committee’s understanding is that the minimum retention time under that Act may vary depending on the type of document or body, and the response provided does not indicate with sufficient detail the amount of time for which these specific records would be retained. The committee therefore considers that it is unclear how long personal information is to be retained. The committee considers the bill should provide that personal information be destroyed once it has fulfilled the purpose for which it was obtained (namely the allocation of a unique student identifier).

2.23 Further, the committee welcomes the advice that consideration is being given to potential opt-out processes. Again, given the significant privacy implications for the scheme and the fact that it impacts on minors, the committee considers that full consideration to this issue should have been provided prior to the implementation of this bill. Opt-out processes and procedures should have been set out on the face of the bill to ensure the protections are in primary law and could be given full parliamentary consideration. This is particularly the case noting no decisions have yet been made as to whether there will be any opt-in or opt-out arrangements (which is highly relevant to assessing whether the trespass on privacy is proportionate).

2.24 In addition, the committee notes the advice that a Privacy Impact Assessment was completed in May 2024 in relation to the bill, which identified that while the bill will impact on individual privacy, this was to be weighed against the ‘considerable’ benefits to the community at large. It is not uncommon for explanatory materials to facilitate access to Privacy Impact Assessments undertaken in relation to a bill. In this instance, the committee queries why this information was not made available within the explanatory memorandum for the benefit of Parliament in considering the legislation.

2.25 Finally, the committee welcomes the information that it is intended that any protected information disclosed by the Student Identifiers Registrar will be de-identified. However, as noted elsewhere in this entry, the Data Governance Framework does not have legislative status and this protection should be set out in primary legislation. As it stands, the ‘intention’ to include a protection in a future agreement which may not have legislative status does not afford the level of protection the committee expects. Noting that the intention is for information to be de-identified it is unclear to the committee why the matters are being left to the Data Governance Framework. The committee therefore considers that the bill should be amended to provide that any protected information disclosed by the Student Identifiers Registrar under the scheme for research purposes must be de-identified.

2.26 The committee retains significant scrutiny concerns that, noting the privacy implications of the bill, the bill does not contain sufficient legislative safeguards to protect privacy. The vast majority of the specified safeguards are not set out in primary legislation and are instead left to non-legislative materials such as the Data Governance Framework. As such, this severely limits parliamentary oversight of these measures. The committee is concerned that this is essentially a framework bill that will leave matters of significance relating to the privacy of all school children to non-legislative executive control and delegated legislation, with limited parliamentary involvement.

2.27 The committee is of the view that the bill should be amended to include clear and accessible opt-out procedures for all parents and carers who do not want their children’s information collected, used and disclosed under the scheme. The committee also considers the bill should be amended to require the de-identification of any personal information disclosed for research purposes by the Student Identifier Registrar, specification of the type of personal information that can be collected and to provide an appropriate limit on the duration of time for which student identifiers and associated records can be retained.

2.28 The committee draws these scrutiny concerns to the attention of senators and leaves to the Senate as a whole the appropriateness of:

2.29 The committee requests that an addendum to the explanatory memorandum containing the justification for the expansion of the scheme to school children provided by the minister be tabled in the Parliament as soon as practicable, noting the importance of these explanatory materials as a point of access to understanding the law and, if needed, as extrinsic material to assist with interpretation.^[69]

2.30 The committee also draws these matters to the attention of the Senate Standing Committee for the Scrutiny of Delegated Legislation.

Privacy
Inappropriate delegation of legislative powers
Parliamentary oversight ^[70]

2.31 Currently the Act provides that the Registrar is authorised to collect, use or disclose a student identifier for purposes specified in section 18 of the Act. These purposes include for research that directly or indirectly relates to education or training, or that requires the use of student identifiers or information about education or training and that meets the requirements specified by the Ministerial Council. ^[71]

2.32 This bill seeks to expand the nature of information the Registrar can disclose to ‘protected information’, which includes school and student identifier information.^[72] The bill also provides that Registrar would be enabled to use or disclose protected information if the use or disclosure is for the purpose of research:

2.33 As such, in order for protected information to be disclosed for the purposes of research it must meet non-legislative requirements specified by an executive body, namely the EMC. The statement of compatibility states that this will ensure appropriate limits are placed around this disclosure power.^[74]

2.34 As such, in Scrutiny Digest 10 of 2024 the committee requested the minister’s as to:

Minister for Education’s response^[76]

2.35 In relation to why it is necessary and appropriate for safeguards to be set by the education ministerial council, the minister advised that under the relevant intergovernmental agreements, the Education Ministers Meeting is responsible for overseeing implementation of the agreement and the Commonwealth and jurisdictions commit to working together. The minister advised this is subject to an Education Ministers Meeting considering and agreeing to the cost and cost sharing arrangements, scope and governance of each initiative, acknowledging the different local contexts and starting points of each jurisdiction and that implementing the Schools USI, which is a National Policy Initiative, is a condition of Commonwealth funding provided to states and territories under the Act.

2.36 The minister clarified the definition of Education Ministerial Council (EMC) and advised that the inclusion of a body prescribed in the regulations is included within this definition to ensure that decision-making in relation to the Act can progress in the improbable circumstance in which there was no EMC.

2.37 The minister advised that the Education Ministers are establishing a Schools USI Data Governance Framework that will specify the requirements that must be met for protected information to be disclosed for research purposes. The minister advised this is an important safeguard and will be established and agreed to before school identifiers are assigned to students.

2.38 In relation to whether guidance can be provided as to when a research purpose is sufficiently related to ‘school education’, the minister advised that matters relating to primary or secondary school education would reasonably fall within the scope of the responsibilities of the Education Ministers. The minister also noted that any use of school identifiers, school identity management information and student identifiers for school education research purposes will require the agreement of Education Ministers.

Committee comment

2.39 The committee thanks the minister for this response. While the committee acknowledges that this scheme is part of an intergovernmental agreement, as set out above, the committee retains scrutiny concerns with allowing the EMC to determine the requirements to be met before the Registrar is authorised to disclose protected information for research purposes. The committee remains concerned that the disclosure of protected information is determined by non-legislative requirements and that these requirements would not be subject to any parliamentary oversight, such as if it were included in primary legislation or, at a minimum, in a disallowable legislative instrument.

2.40 The committee also does not consider that the inclusion of the requirements within the Schools USI Data Governance Framework is an appropriate safeguard, as this is a non-legislative document that would not be subject to any parliamentary oversight. Further, this is does not address the committee’s request for examples as to the types of requirements that must be satisfied prior to disclosure of protected information. As this document has yet to be made available, it is also not possible to refer to the requirements to assess the appropriateness of the requirements for disclosure.

2.41 The committee also reiterates its concern that the EMC would be enabled to determine the circumstances of proposed subsection 18(5) of the bill, rather than being bound by the circumstances detailed in the bill. In addition to the requirements specified by the EMC not being subjected to ordinary parliamentary oversight processes and scrutiny, the committee remains deeply concerned that the EMC requirements may determine the operation of the bill and the Registrar’s functions. The committee finally reiterates its view that this is an inappropriate delegation of legislative power and that this aspect of its concerns has not been addressed in the response.

2.42 The committee remains concerned that the disclosure of protected information will be determined by non-legislative requirements that would be agreed on by the Education Ministerial Council, and that these requirements would not be subject to any parliamentary oversight. The committee considers this to be an inappropriate delegation of legislative power and fails to ensure sufficient parliamentary oversight.

2.43 The committee therefore draws its scrutiny concerns to the attention of senators and leaves to the Senate as a whole the appropriateness of proposed subsection 18(5) of the bill providing for the disclosure of protected information for the purposes of school education research on the basis of meeting requirements determined by the Education Ministerial Council.

Privacy
Significant matters in delegated legislation^[77]

2.44 Further to the above matters, this bill also seeks to amend the Act to provide that an ‘entity prescribed by the regulations’ is authorised to collect, use or disclose protected information of an individual if the collection, use or disclosure is for a purpose or circumstances relating to school education and prescribed by the regulations. As set out above, the collection, use or disclosure of protected personal information raises significant privacy concerns and the entity that is authorised to do this is a significant matter over which Parliament should exercise control.

2.45 As such, in Scrutiny Digest 10 of 2024 the committee requested the minister’s advice to following:

Minister for Education’s response^[79]

2.46 The minister advised that the bill provides authority to key legal structures and entities that are expected to administer unique school identifiers. The minister advised this also includes legal entities in the non-government school sector that are not ‘approved authorities’ under the Australian Education Act 2013 which could be used to support administration activities for schools. The minister advised that the intention is that the regulations will identify any such specific legal structures to be used in the administration of schools identifiers.

2.47 In relation to the circumstances in which protected information may be collected, used or disclosed, the minister advised that the Education Ministers agreed in 2022 to a single use case for the scheme (which is to support the transfer for student information where individuals move between schools) and that the regulations will make provision for this agreed use. Further, the minister advised that it is necessary and appropriate for other future uses of the scheme to be prescribed in the regulations as this reflects the nature of the scheme as a joint initiative. The minister also noted that it is not possible to pre-empt the future uses that Education Ministers will decide for the scheme, nor would it be appropriate for the Commonwealth to bind the states and territories to future uses which they have not agreed to. The minister advised that the regulations for school identifiers can only be made with agreement from the Education Ministerial Council.

Committee comment

2.48 The committee thanks the minister for this response. The committee notes the minister’s advice that the bodies intended to be prescribed by regulations include legal entities and structures that could be used to support administration activities for schools and makes no further comment on this issue.

2.49 The committee does not consider that prescribing broad circumstances in the regulations to allow for the use, collection and disclosure of protected information, that may be consistent with future uses that may be agreed to by Education Ministers, is an appropriate use of delegated legislation or is a justification for why prescribing these circumstances in the regulations is necessary or appropriate. The committee considers that the known circumstance (that of a single use case for the Schools USI scheme) should be included on the face of the bill. In the event that the Education Ministers agree to a separate use for the scheme in the future, the committee considers that the Act should be amended at that time to capture these future uses. As stated by the minister, since it is not possible to pre-empt future uses at this stage, it is inappropriate to legislate on the basis of these unknown future uses.

2.50 Additionally, the committee considers that at the very least, the primary legislation should indicate that regulations in relation to school identifiers should also provide some guidance as to the circumstances in which protected information will be collected, used or disclosed by an entity prescribed by the regulations. The committee considers that this would provide some certainty as to the circumstances in which the protected information of children may be collected, use and disclosed by prescribed entities.

2.51 The committee draws its scrutiny concerns to the attention of senators and leaves to the Senate as a whole the appropriateness of proposed section 18D of the bill, which allows for the circumstances in which protected information may be collected, used or disclosed to be prescribed in the regulations.

2.52 The committee also draws this matter to the attention of the Senate Standing Committee for the Scrutiny of Delegated Legislation.

^[62] The concerns relate to the bill as a whole. The committee draws senators’ attention to the bill pursuant to Senate standing order 24(1)(a)(i).

^[66] See Senate Standing Committee for the Scrutiny of Bills, Ninth Report of 2014 (16 July 2014) pp. 368–372.

^[68] The minister responded to the committee’s comments in a letter dated 5 September 2024. A copy of the letter is available on the committee’s webpage (see correspondence relating to Scrutiny Digest 11 of 2024 ).

^[70] Schedule 1, item 46, proposed subsection 18(5). The committee draws senators’ attention to this provision pursuant to Senate standing order 24(1)(a)(i), (iv) and (v).

^[72] Schedule 1, item 4, proposed subsection 4(1), definition of ‘protected information’.

^[73] Schedule 1, item 4, proposed subsection 4(1), definition of ‘Education Ministerial Council’.

^[76] The minister responded to the committee’s comments in a letter dated 5 September 2024. A copy of the letter is available on the committee’s webpage (see correspondence relating to Scrutiny Digest 11 of 2024).

^[77] Schedule 1, item 47, proposed section 18D. The committee draws senators’ attention to this provision pursuant to Senate standing order 24(1)(a)(i) and (iv).

^[79] The minister responded to the committee’s comments in a letter dated 5 September 2024. A copy of the letter is available on the committee’s webpage (see correspondence relating to Scrutiny Digest 11 of 2024).

Australian Senate Standing Committee for the Scrutiny of Bills - Scrutiny Digests